Attribution
Online persona, not an independent intrusion set; called 'Karma' (also written 'KarMa') in vendor reporting, with Karmabelow80 as its website name. Assessed as operated by Void Manticore (Iran, MOIS-affiliated) - Medium confidence: Check Point Research says Void Manticore 'likely operates the Karma persona and utilizes access previously obtained by Scarred Manticore'; MITRE ATT&CK lists Karma and Karmabelow80 under VOID MANTICORE (G1055); and the US DOJ describes Karmabelow80[.]org as an official website of 'a shell hacktivist entity used by MOIS', without naming Void Manticore. Claims published under the persona are the operator's own assertions unless independently corroborated.
Origin
Iran (operator assessed)
First seen
2023 (Telegram channel soon after the Israel-Hamas war broke out in October 2023; website launched November 2023, per Check Point Research)
Last active
Unknown - Check Point Research (2026) describes Karma's 'complete disappearance' and assesses the persona was likely completely replaced by Handala
Motivation
Destructive and psychological operations against Israel - wiper attacks and hack-and-leak, presented as 'Anti-Zionist Jewish Hackers'
Attribution confidence
medium
Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel.
What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.
No open hunts or recent alerts tracked against this actor right now.